Understanding Alarms

Cisco Unified Serviceability alarms provide information on runtime status and the state of the system, so you can troubleshoot problems that are associated with your system; for example, to identify issues with the Disaster Recovery System. Alarm information, which includes an explanation and recommended action, also includes the application name, machine name, and so on, to help you perform troubleshooting. If you have clusters, this is even true for problems that are not on your local Cisco Unified Communications Manager or Cisco Unity Connection server.

You configure the alarm interface to send alarm information to multiple locations, and each location can have its own alarm event level (from debug to emergency). You can direct alarms to the Syslog Viewer (local syslog), Syslog file (remote syslog), an SDI trace log file, an SDL trace log file (for Cisco CallManager and CTIManager services only), or to all destinations.

When a service issues an alarm, the alarm interface sends the alarm information to the locations that you configure (and that are specified in the routing list in the alarm definition) (for example, SDI trace). The system can either forward the alarm information, as is the case with SNMP traps, or the system can write the alarm information to its final destination (such as a log file).

Tip For the Remote Syslog Server, do not specify a Cisco Unified Communications Manager server, which cannot accept syslog messages from other servers.

You use the Trace and Log Central option in the Cisco Unified Real-Time Monitoring Tool (RTMT) to collect alarms that get sent to an SDI trace log file or SDL trace log file (for Cisco CallManager and CTIManager services only). You use the SysLog Viewer in RTMT to view alarm information that gets sent to the local syslog.

Alarm Configuration

You can configure alarms for services, such as Cisco Database Layer Monitor, in Cisco Unified Serviceability. Then, you configure the location(s), such as Syslog Viewer (local syslog), where you want the system to send the alarm information. With this option, you can

•Configure alarms for services on a particular server or on all servers (Unified CM clusters only)

•Configure different remote syslog servers for the configured service(s) or server(s)

•Configure different alarm event level settings for different destinations

Cisco Syslog Agent enterprise parameters in Cisco Unified Communications Manager Administration allow you to forward all alarms that meet or exceed the configured threshold to a remote syslog server with these two settings: remote syslog server name and syslog severity. To access these Cisco Syslog Agent parameters, go to the applicable window for your configuration:

The alarms include system (OS/hardware platform), application (services), and security alarms. If you have a Cisco Unified Communications Manager Business Edition server, the system also forwards Cisco Unity Connection alarms.

Note If you configure both the Cisco Syslog Agent alarm enterprise parameters and application (service) alarms in Cisco Unified Serviceability, the system can send the same alarm to the remote syslog twice.

If local syslog is enabled for an application alarm, the system sends the alarm to the enterprise remote syslog server only when the alarm exceeds both the local syslog threshold and the enterprise threshold.

If remote syslog is also enabled in Cisco Unified Serviceability, the system forwards the alarm to the remote syslog server by using the application threshold that is configured in Cisco Unified Serviceability, which may result in the alarm getting sent to the remote syslog server twice.

The event level/severity settings provide a filtering mechanism for the alarms and messages that the system collects. This setting helps to prevent the Syslog and trace files from becoming overloaded. The system forwards only alarms and messages that exceed the configured threshold.

Alarm Definitions

Used for reference, alarm definitions describe alarm messages: what they mean and how to recover from them. You search the Alarm Definitions window for alarm information. When you click any service-specific alarm definition, a description of the alarm information (including any user-defined text that you have added) and a recommended action display.

You can search for definitions of all alarms that display in Cisco Unified Serviceability. To aid you with troubleshooting problems, the definitions, which exist in a corresponding catalog, include the alarm name, description, explanation, recommended action, severity, parameters, monitors, and so on.

When the system generates an alarm, it uses the alarm definition name in the alarm information, so you can identify the alarm. In the alarm definition, you can view the routing list, which specifies the locations where the system can send the alarm information. The routing list may include the following locations, which correlate to the locations that you can configure in the Alarm Configuration window:

•Unified CM and Unified CM BE only: SDL—The system sends the alarm information to the SDL trace if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.

•SDI —The system sends the alarm information to the SDI trace if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.

•Sys Log—The system sends the alarm information to the remote syslog server if you enable the alarm for this option, specify an appropriate event level in the Alarm Configuration window, and enter a server name or IP address for the remote syslog server.

•Event Log—The system sends the alarm information to the local syslog, which you can view in the SysLog Viewer in the Cisco Unified Real-Time Monitoring Tool (RTMT), if you enable the alarm for this option and specify an appropriate event level in the Alarm Configuration window.

•Unified CM and Unified CM BE only: SNMP Traps—System generates an SNMP trap. You cannot configure this option in the Alarm Configuration window.

Note Cisco Unified Communications Manager supports SNMP traps in Unified CM and Unified CM BE systems. Cisco Unity Connection SNMP does not support traps in either Unified CM BE or Connection systems.

Tip If the SNMP Traps location displays in the routing list, the system forwards the alarm information to the CCM MIB SNMP agent, which generates the appropriate traps according to the definition in CISCO-CCM-MIB.

The system sends an alarm if the configured alarm event level for the specific location in the Alarm Configuration window is equal to or lower than the severity that is listed in the alarm definition. For example, if the severity in the alarm definition equals WARNING_ALARM, and, in the Alarm Configuration window, you configure the alarm event level for the specific destination as Warning, Notice, Informational, or Debug, which are lower event levels, the system sends the alarm to the corresponding destination. If you configure the alarm event level as Emergency, Alert, Critical, or Error, the system does not send the alarm to the corresponding location.

For each Cisco Unified Serviceability alarm definition, you can include an additional explanation or recommendation. All administrators have access to the added information. You directly enter information into the User Defined Text pane that displays in the Alarm Details window. Standard horizontal and vertical scroll bars support scrolling. Cisco Unified Serviceability adds the information to the database.

Viewing Alarm Information

You view alarm information to determine whether problems exist. The method that you use to view the alarm information depends on the destination that you chose when you configured the alarm. You can view alarm information that is sent to the SDI trace log file, or SDL trace log file (Cisco Unified Communications Manager and Cisco Unified Communications Manager Business Edition only) by using the Trace and Log Central option in RTMT or by using a text editor. You can view alarm information that gets sent to local syslog by using the SysLog Viewer in RTMT.

In Cisco Unified Serviceability, configure the server(s), service(s), destination(s), and event level(s) for the applications (services) alarm information that you want to collect.

•All services can go to the SDI log (but must be configured in Trace also).

•All services can go to the SysLog Viewer.

•Unified CM and Unified CM BE only: Only the Cisco CallManager and Cisco CTIManager services use the SDL log.

•To send syslog messages to the Remote Syslog Server, check the Remote Syslog destination and specify a host name. If you do not configure the remote server name, Cisco Unified Serviceability does not send the Syslog messages to the remote syslog server.

Tip Do not configure a Cisco Unified Communications Manager server as a remote Syslog server.